YARA · Costin Raiu yararules

CRAIU_Unk_Liblzma_Encstrings

liblzma backdoor, encoded strings

MalwareCostin Raiu yararulesGNU General Public License v3.0Compiles with YARA-X

Author: Costin G. Raiu, Art of Noh, craiu@noh.ro
Date: 2024-03-30
Score / Quality: 75 / 85

What this rule detects

liblzma backdoor, encoded strings

It defines 3 patterns (1 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

unk-liblzma-encstrings.yarGNU General Public License v3.0

rule CRAIU_Unk_Liblzma_Encstrings : FILE
{
	meta:
		description = "liblzma backdoor, encoded strings"
		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
		id = "ca491b9c-400e-5f5e-9372-e403a095edba"
		date = "2024-03-30"
		modified = "2024-03-30"
		reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01"
		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/unk_liblzma_backdoor.yara#L32-L70"
		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
		logic_hash = "99f5c82f941bb5c1f908209e108f9f80a835ad84157a383faa0dde502486dbd3"
		score = 75
		quality = 85
		tags = "FILE"
		version = "1.0"

	strings:
		$a1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj" ascii wide
		$a2 = { 04 00 10 08 03 00 00 00 03 00 00 00 03 00 00 00 04 00 78 06 03 00 00 00 03 00 00 00 30 00 0C 00 03 00 00 00 04 00 D8 00 
              03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 43 00 00 00 32 00 00 00 03 00 00 00 03 00 00 00 13 01 00 00  
              92 00 00 00 12 00 00 00 42 00 00 00 93 00 00 00 62 00 00 00 B3 00 00 00 B2 00 00 00 03 00 00 00 03 00 00 00 93 00 00 00 
              42 00 00 00 C3 00 00 00 B2 00 00 00 03 00 00 00 12 00 00 00 04 00 08 07 04 00 08 01 12 00 00 00 63 00 00 00 03 00 00 00
              13 00 00 00 F2 00 00 00 03 00 00 00 A3 00 00 00 92 00 00 00 33 01 00 00 F2 00 00 00 43 01 00 00 22 00 00 00 22 01 00 00 
              04 00 70 08 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 92 00 00 00 83 00 00 00 23 00 00 00 82 01 00 00 63 01 00 00  
              13 00 00 00 04 00 A0 01 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 B2 01 00 00 03 00 00 00 03 00 00 00 03 00 00 00
              23 01 00 00 43 00 00 00 C2 00 00 00 90 01 30 00 72 00 00 00 21 01 04 00 03 01 00 00 92 00 00 00 22 01 00 00 32 00 00 00 }
		$a3 = {
              33 01 00 00 D2 00 00 00 12 00 00 00 13 00 00 00 04 00 40 0C E2 00 00 00 03 00 00 00 53 01 00 00 22 01 00 00 04 00 D0 06
              E2 00 00 00 A3 00 00 00 92 00 00 00 53 01 00 00 A0 00 14 00 D2 01 00 00 04 00 58 09 62 00 00 00 92 00 00 00 04 00 18 04  
              42 01 00 00 13 00 00 00 B3 01 00 00 04 00 E0 04 33 00 00 00 A2 01 00 00 43 01 00 00 92 00 00 00 A2 00 00 00 33 02 00 00 
              72 01 00 00 10 00 40 00 A0 00 30 00 00 02 20 00 A2 00 00 00 21 00 0C 00 12 00 00 00 04 00 90 07 B2 01 00 00 53 00 00 00  
              93 01 00 00 92 00 00 00 22 01 00 00 83 01 00 00 53 00 00 00 82 00 00 00 32 01 00 00 03 02 00 00 62 01 00 00 63 01 00 00 
              B2 00 00 00 22 01 00 00 33 00 00 00 33 00 00 00 73 00 00 00 04 00 18 00 D2 01 00 00 13 02 00 00 52 00 00 00 D3 00 00 00 
              02 01 00 00 C3 00 00 00 52 00 00 00 D3 00 00 00 B2 01 00 00 A3 01 00 00 23 00 00 00 E2 01 00 00 33 00 00 00 33 00 00 00
              B3 01 00 00 A2 00 00 00 53 00 00 00 B3 00 00 00 C2 01 00 00 D3 01 00 00 03 00 00 00 22 00 00 00 63 00 00 00 12 00 00 00 }

	condition:
		( filesize < 15MB ) and ( any of them )
}

Strings (3 patterns)

Identifier	Type	Value	Modifiers
$a1	text	"yolAbejyiejuvnup=Evjtgvsh5okmkAvj"	ascii wide
$a2	hex	{ 04 00 10 08 03 00 00 00 03 00 00 00 03 00 00 00 04 00 78 06 03 00 00 00 03 00 00 00 30 00 0C 00 03 00 00 00 04 00 D8 00 03 00 00 00 03 00 00 00 …
$a3	hex	{ 33 01 00 00 D2 00 00 00 12 00 00 00 13 00 00 00 04 00 40 0C E2 00 00 00 03 00 00 00 53 01 00 00 22 01 00 00 04 00 D0 06 E2 00 00 0 …

Condition

( filesize < 15MB ) and ( any of them )

In plain words (Heuristic)

The file must be smaller than 15MB (a cheap guard that skips large files).
At least one pattern in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01

Licence & attribution

Author: Costin G. Raiu, Art of Noh, craiu@noh.ro

Source repository: Costin Raiu yararules @ 23cf0ca220

Licence: GNU General Public License v3.0 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: ca491b9c-400e-5f5e-9372-e403a095edba

Metadata

version	1.0

Tags:FILE

CRAIU_Crime_Noabot
MalwareCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-01-11
CRAIU_Unk_Liblzma_Backdoor
MalwareCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-03-30
CRAIU_Crashstrike
GenericCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-07-19
CRAIU_Susp_Ios_Shutdown
Suspicious / huntingCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2023-12-28